From d20cee94dc7ee118f4c18380d7c03e9069d5bb42 Mon Sep 17 00:00:00 2001
From: Jonathan Haas <jonathan@haas.holdings>
Date: Tue, 4 Aug 2026 13:41:56 -0700
Subject: [PATCH] fix(db): preserve applied migration checksums

---
 crates/corpus-core/src/db.rs                  | 15 ++++++++++++
 migrations/0002_agents.sql                    |  7 ++----
 migrations/0013_agent_tenant_foreign_keys.sql | 23 +++++++++++++++++++
 3 files changed, 40 insertions(+), 5 deletions(-)
 create mode 100644 migrations/0013_agent_tenant_foreign_keys.sql

diff --git a/crates/corpus-core/src/db.rs b/crates/corpus-core/src/db.rs
index 734f5b1..97b4b65 100644
--- a/crates/corpus-core/src/db.rs
+++ b/crates/corpus-core/src/db.rs
@@ -139,4 +139,19 @@ mod tests {
             );
         }
     }
+
+    #[test]
+    fn applied_agent_migration_checksum_is_immutable() {
+        use sha2::{Digest, Sha256};
+        use std::{fs, path::Path};
+
+        let migration =
+            Path::new(env!("CARGO_MANIFEST_DIR")).join("../../migrations/0002_agents.sql");
+        let checksum = hex::encode(Sha256::digest(fs::read(migration).expect("read migration")));
+
+        assert_eq!(
+            checksum, "45f16bac4c5d1021f7ed9636ebfa203767b828807bbaf53b7f6f53d2aeebb8d1",
+            "migration 0002 is already applied in production and must not be edited"
+        );
+    }
 }
diff --git a/migrations/0002_agents.sql b/migrations/0002_agents.sql
index 4a2c0e0..433213f 100644
--- a/migrations/0002_agents.sql
+++ b/migrations/0002_agents.sql
@@ -1,12 +1,9 @@
 -- Milestone 1: agent enrollment, identity, and health (spec 10.1, 10.11).
--- Tenant-scoped like every other data table (0001 tenant registry).
---
--- Agent enrollment tokens, agent rows, heartbeats, and coverage gaps.
 
 -- One-time enrollment tokens minted by operators via corpusctl.
 CREATE TABLE enrollment_token (
   token_sha256        bytea PRIMARY KEY,
-  tenant_id           uuid NOT NULL REFERENCES tenant (id),
+  tenant_id           uuid NOT NULL,
   label               text NOT NULL DEFAULT '',
   created_at          timestamptz NOT NULL,
   expires_at          timestamptz,
@@ -18,7 +15,7 @@ CREATE TABLE enrollment_token (
 -- plaintext token is shown exactly once at enrollment.
 CREATE TABLE agent (
   id                  uuid PRIMARY KEY,
-  tenant_id           uuid NOT NULL REFERENCES tenant (id),
+  tenant_id           uuid NOT NULL,
   host_name           text NOT NULL,
   token_sha256        bytea NOT NULL,
   version             text NOT NULL,
diff --git a/migrations/0013_agent_tenant_foreign_keys.sql b/migrations/0013_agent_tenant_foreign_keys.sql
new file mode 100644
index 0000000..3e8328c
--- /dev/null
+++ b/migrations/0013_agent_tenant_foreign_keys.sql
@@ -0,0 +1,23 @@
+-- Keep migration 0002 immutable; add tenant referential integrity separately.
+-- NOT VALID avoids blocking startup on legacy rows while enforcing the
+-- relationship for all new writes. The constraints can be validated after
+-- existing data is audited.
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'enrollment_token_tenant_id_fkey'
+  ) THEN
+    ALTER TABLE enrollment_token
+      ADD CONSTRAINT enrollment_token_tenant_id_fkey
+      FOREIGN KEY (tenant_id) REFERENCES tenant (id) NOT VALID;
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'agent_tenant_id_fkey'
+  ) THEN
+    ALTER TABLE agent
+      ADD CONSTRAINT agent_tenant_id_fkey
+      FOREIGN KEY (tenant_id) REFERENCES tenant (id) NOT VALID;
+  END IF;
+END $$;